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Flight  Control  Design  Best  Practices 
Relative  to  Active  Control  Technology 

Dr.  David  J.  Moorhouse 
Air  Force  Research  Laboratory /VASD 
2210  Eighth  Street,  Suite  1 
Wright-Patterson  AFB,  Ohio  45433-7542,  USA 


Task  Group  SCI-26  was  formally  initiated  in  1996,  in  response  to  well-publicized  and  highly  visible  accidents  that 
had  occurred  in  the  latest  technology  aircraft  both  in  the  US  and  in  Europe.  These  accidents  were  due  to  deficiencies  in  the 
flight  control  system  designs.  Other  recent  programs  had  less-well-publicized  FCS  development  problems,  with  time  and  cost 
overruns  more  the  rule  than  the  exception.  The  Task  Group  has  just  published  a report,  which  begins  with  a review  of  some 
examples  of  flight  control  problems.  They  span  the  history  of  flight  from  the  time  when  the  practice  of  flying  was  preceding 
theoretical  developments  up  to  more  recent  time  when  it  might  be  drought  that  flight  control  designers  “should  know  better". 
Then  there  is  a chapter  detailing  lessons  learned  from  various  programs  with  positive  results,  which  leads  into  a section 
detailing  a series  of  recommended  best  practices.  The  second  part  of  the  report  continues  with  some  theoretical  aspects.  First, 
there  is  a discussion  of  flying  qualities  criteria,  and  the  cuirent  state  of  the  art  of  “carefree  handling”  which  is  related  to  this 
symposium.  Next  there  is  an  extensive  discussion  of  the  latest  results  from  research  into  PIOs,  followed  by  a discussion  of 
modelling  and  system  identification.  The  Task  Group  members  originally  laid  out  this  report  to  present  an  assessment  of 
design  methods,  but  no  correlation  was  found  between  the  method  used  and  the  problems  of  the  past,  or  the  successes. 

The  theme  of  the  symposium,  "Active  Control  Technology",  is  interpreted  to  mean  the  use  of  flight  control 
technology  to  minimize  the  pilot's  workload  in  accomplishing  every  mission  task.  Specifically,  it  covers  a range  of 
applications  from  tailoring  the  responses  to  prevent  undesirable  characteristics,  such  as  departures  or  limit  exceedances,  all 
the  way  through  to  automatic  recovery  systems  that  take  control  away  from  the  pilot.  The  objective  of  this  paper  is  to 
summarize  the  Task  Group  results  with  particular  emphasis  on  best  design  practices  to  achieve  the  optimum  benefits  from 
active  control  technology  (ACT). 


Introduction 


Flight  control  design  technology  has  evolved  along  with  the 
development  of  the  airplane  itself.  As  flight  envelopes 
expanded  and  mission  tasks  became  more  complex,  flight 
control  design  became  more  sophisticated.  Active  control 
technology,  by  definition,  means  the  tailoring  of  aircraft 
response  to  inputs  beyond  the  basic  pilot  control  and 
maneuvering.  Even  mechanical  systems  in  recent  aircraft 
were  designed  with  scheduling  to  limit  pilot  inputs  in 
certain  conditions,  e.g.  to  minimize  susceptibility  to 
departure.  One  example  is  to  reduce  the  pilot  roll  command 
gain  at  higher  angles  of  attack  in  order  to  prevent  departure. 
The  trend  towards  fly-by-wire  technology  has  given 
designers  even  more  flexibility  in  the  application  of  ACT. 
Another  example  would  be  to  prevent  the  pilot  pitch 
commands  from  causing  the  aircraft  to  exceed  a certain  load 
factor.  These  effects  can  be  achieved  by  tailoring  the 
responses  to  the  pilot  commands  so  that  they  still  appear 
natural,  referred  to  as  ACT1  for  this  discussion.  At  the 
extreme,  however,  is  the  application  of  systems  such  as 
Automatic  Ground  Collision  Avoidance,  where  control  is 
taken  away  from  the  pilot  completely,  ACT2  when  there  is 
any  distinction  to  be  made.  In  all  cases  we  can  consider  that 


ACT  is  an  extension  of  basic  flight  control  design  and 
should  be  integrated  as  much  as  possible. 

The  previous  RTO  symposium  on  ACT  was  in  1994, 
"Active  Control  Technology:  Applications  and  Lessons 
Learned",  AGARD-CP-560.  The  Technical  Evaluator 
stated:  "An  AGARD  Working  Group  might  be  the  proper 
means  to  consolidate  valuable  insights  gained  during  recent 
demonstrator  and  prototype  projects  ....".  A Working  Group 
was  formed  and  has  just  completed  a technical  report  which 
is  in  publication,  Reference  1.  As  stated  in  the  report, 
problems  have  occurred  from  the  very  beginning  of  flight  up 
to  the  present  time  where  it  might  be  thought  that  "designers 
should  know  better".  Also,  FCS  problems  are  not  unique  to 
digital  systems,  there  have  been  problems  with  every  form 
of  FCS.  There  are,  however,  unique  aspects  of  fly-by-wire 
(FBW)  control  systems.  The  most  obvious,  and  frequently 
the  most  important,  is  that  there  is  no  direct  connection 
between  the  pilot  and  the  control  surfaces.  Since  an  extreme 
application  of  ACT  is  to  take  control  away  from  the  pilot, 
special  attention  is  required  to  provide  appropriate 
connectivity  through  the  design  of  the  FBW  system.  In 
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addition,  the  very  flexibility  of  the  digital  technology  has 
also  given  designers  more  flexibility  for  error  in  new  ways. 
Reference  1 contains  recommended  Best  Practices  for  FCS 
design.  The  object  of  this  paper  is  to  discuss  each  of  the 
recommendations  from  that  report  in  the  context  of  applying 
ACT  to  a system  design.  It  can  also  be  admitted  that  some 
points  are  made  repeatedly  for  additional  emphasis. 

Background 

For  the  purposes  of  this  discussion,  we  can  assume  that 
artificial  stabilization  is  common.  The  focus  of  Active 
Control  Technology  is  the  extension  of  flight  control  design 
beyond  stabilization  and  control.  The  term  "carefree 
handling"  is  typically  used  to  designate  the  design  of  the 
control  laws  to  prevent  pilot  inputs  that  would  cause 
departures,  exceeding  limit  loads,  etc.  Then  we  can  consider 
a progression  to  recovery  directions  for  the  pilot  to  follow, 
through  to  complete  intervention  of  the  control  system. 

The  initial  elements  of  ACT  can  be  considered  to  be  in 
systems  like  stick  pushers  as  an  indication  of  approach  to 
stall.  The  later  aircraft  with  mechanical  control  systems, 
such  as  the  F-15,  included  ACT  in  the  form  of  command 
gain  reduction  to  minimize  departure  susceptibility.  Fly-by- 
wire technology  has  given  designers  even  more  freedom  to 
develop  the  technology.  In  Reference  1,  the  application  of 
“carefree”  handling  to  two  aircraft  with  different  technology 
status  is  discussed.  An  existing  aircraft  can  be  upgraded 
during  its  lifetime  with  the  new  technology  development. 
There  is  also  discussion  of  what  is  possible  today  for  a 
combat  aircraft  of  the  newest  generation.  The  principle  is 
the  same  for  both,  a reliable  control  system  with  a good 
sensor  system  for  measuring  the  flight  condition  enables  the 
implementation  of  “carefree  handling”.  The  primary 
difference  is  whether  the  functions  are  added  to  an  existing 
control  system,  or  can  be  integrated  into  a new  design  from 
the  start. 

Also  as  discussed  in  Reference  1,  a Pilot  Activated 
Recovery  System  has  been  shown  to  be  effective.  This 
system  was  pilot  selected  and  provided  guidance  which 
mimicked  the  recovery  procedures  that  are  taught  to  the 
pilots.  It  was  very  acceptable  to  the  pilots,  since  it  only 
provided  guidance  as  an  aid  to  manual  control. 

The  above  approaches  are  oriented  towards  helping  the  pilot 
to  the  maximum  extent.  There  still  exist  possibilities  where 
the  pilot  does  not  realize  the  situation  or  is  temporarily 
incapacitated.  In  addition,  there  have  been  many  accidents 
where  warnings  were  not  sufficient.  A human  pilot  in  a 
stressful  situation  will  ignore  everything  except  a primary 
focus  which  may  not  be  the  correct  one.  This  leads  to 
consideration  of  fully  automatic  systems  to  take  over 
control.  The  flight  lest  results  from  an  Auto  Ground 
Collision  Avoidance  System  program  show  the  benefits  of 


an  automated  system  (see  References  2 - 4).  It  shows  that 
nuisance  warnings  are  almost  zero  and  that  interference  with 
the  pilot  is  basically  non-existent.  Pilot  acceptance  of 
automated  systems  has  been  a problem  in  the  past.  This 
reluctance  was  based  on  insufficient  knowledge  of 
automated  system  operation  or  experience  with  inadequate 
manual  systems.  Future  aircraft  will  be  more  complex  both 
in  pilot  workload  and  in  display  technology.  These  facts 
alone  will  make  the  need  for  more  automation  imperative. 
An  automatic  GCAS  has  the  advantage  over  a manual 
GCAS  in  that  it  does  not  have  to  compensate  for  the  pilot’s 
reaction  time.  This  fact  alone  should  eliminate  most 
nuisance  activation.  There  are  still  database  errors  that  can 
cause  nuisance  cases.  As  the  database  gets  more  accurate 
over  time,  these  also  will  be  eliminated. 

All  the  design  aspects  of  ACT  and  carefree  handling  are 
subject  to  the  Best  Practices  discussed  later.  An  early 
program  decision  is  mandatory  to  define  the  extent  of  the 
technology.  It  does  increase  the  design  effort  and  therefore 
must  be  justified.  Even  in  the  simulation  and  especially  in 
flight  test  a higher  effort  is  needed  to  clear  the  aircraft  for 
“carefree”  maneuvering.  Nevertheless  the  advantages  are  so 
big  that  it  should  be  considered  for  every  modem  combat 
aircraft.  In  addition,  many  aspects  could  transition  into 
commercial  and  military  transport  aircraft.  The  problem 
may  be  cost,  unless  it  can  be  justified  on  the  basis  of 
improved  safety. 

The  Design  Process 

The  flight  control  system  design  process  is  expressed  in 
graphical  form  in  Figure  1 . 

This  figure  can  be  interpreted  to  apply  to  both  an  upgrade 
and  a new  design.  It  shows  a logical  process,  starting  with 
consideration  of  the  various  requirements,  to  establish  a 
well-defined  set  of  FCS  design  criteria.  This  is  the  time 
when  the  application  and  extent  of  ACT  should  be  defined. 
The  best  results  will  be  achieved  if  ACT  is  included  in  the 
design  requirements  and  the  design  process  as  early  as 
possible.  It  is  essential  that  the  whole  team  understands 
these  requirements.  These  allow  definition  of  the  control 
law  architecture  and  an  initial  design  to  be  established.  This 
is  also  the  point  at  which  consideration  of  non-linearities 
should  start,  such  as  those  associated  with  actuation  system 
specifications,  aerodynamic  characteristics,  etc. 

Some  aspects  of  ACT  can  be  included  in  the  initial  design 
requirements,  such  as  load  factor  protection.  Others  may 
need  to  be  considered  as  a response  to  problems  that  are 
encountered  in  flight  test.  It  is  quite  common  in  the  later 
stages  of  FCS  verification  and  validation  to  perform 
sensitivity  analyses  accounting  for  uncertainties  in  the 
aerodynamic  model  used  in  the  design  process.  These 
analyses  are  intended  to  ensure  system  stability  for  a certain 
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MISSION  REQUIREMENTS 


Figure  1.  Flight  Control  System  Design  Process 

percentage  variation  in  aerodynamic  derivatives.  It  may 
also  be  worth  doing  "what  if'  exercises  to  discuss  potential 
approaches  if  there  is  some  variation  beyond  these  values. 
What  if  lateral/directional  coupling  is  significantly  different 
from  predictions.  Is  there  a feedback  or  command  path  that 
would  be  required  that  is  not  in  the  basic  control  laws?  One 
may  decide  that  it  is  prudent  to  include  such  a path  with 
zero  initial  gain  as  cheap  insurance. 

After  the  design  requirements  are  defined  and  agreed,  there 
is  then  a loop  of  analyses  to  ensure  that  the  control  law 
design  meets  the  criteria  that  were  established.  These 
analyses  should  be  a package  of  methods  that  are 
complementary,  documented  and  can  initially  be  informal, 
but  must  be  thorough.  The  recommended  approach  to 
achieving  satisfactory  flying  qualities  is  to  assess  the 
predicted  responses  to  cover  all  flight  conditions,  including 
all  non-linearities  and  pilot  input  amplitudes.  This  becomes 
especially  important  if  we  are  considering  ACT  as 
protection  at  the  extremes  of  the  flight  envelope.  One 
critical  aspect  of  the  process  follows  the  assessment  in 
piloted  simulation,  any  deficiencies  must  be  corrected  by 
analysis. 


Design  Best  Practices 

The  design  process  should  not  be  considered  as  a rigid 
serial  process,  even  though  it  is  convenient  to  discuss  it  that 
way  as  in  Figure  1.  In  fact,  many  parts  are  performed 
concurrently  and/or  in  iterative  loops  but  it  is  necessary  to 
keep  the  total  process  in  mind  in  order  to  maintain  the 
appropriate  connections  between  the  various  components. 
Similarly,  the  following  Best  Practices  should  be  considered 
in  total  and  not  serially. 

Establishmg  aerodynamic  design  and  system  performance 
requirements 

Some  of  the  difficulties  associated  with  flight  control  laws 
design  can  be  created  very  early  in  an  aircraft’s  life-cycle  by 
the  design  of  the  airframe  and  the  related  performance 
specifications  used  for  its  FCS  hardware.  It  is  important  that 
the  control  law  designer  is  involved  in  the  definition  of  the 
aerodynamic  characteristics  and  the  associated  FCS 
equipment  performance,  at  an  early  stage.  He  or  she  should 
also  be  involved  in  aspects  of  the  wind  tunnel  testing  as  the 
user  of  those  characteristics.  If  these  are  not  satisfactory,  he 
may  be  tasked  with  compensating  for  undesirable  physical 
behavior  by  including  appropriate  functionality  within  the 
flight  control  algorithms.  Whilst  it  is  accepted  practice  to 
provide  artificial  stabilization,  there  are  bounds  on  what  can 
be  safely  achieved,  simply  due  to  the  laws  of  physics.  Even 
before  the  physical  limit  is  reached,  the  financial  cost  of 
providing  artificial  stability  may  be  very  high,  owing  to  the 
required  performance  of  the  FCS  hardware. 

There  are  specific  recommended  best  practices  addressing 
sizing  and  placement  of  control  surfaces,  specification  of 
data  sensors  and  actuation  system  characteristics.  These 
areas  are  particularly  susceptible  to  being  frozen  early  in  the 
design  process. 

It  is  tempting  to  avoid  analysis  of  non-linearities  in  the  early 
stages,  because  they  would  mainly  be  engineering 
judgement.  The  real  problem  occurs  if  early  decisions  are 
made  without  any  analysis  and  data.  There  is  always 
resistance  to  changes,  which  only  increases  through  the 
stages  of  the  design  process.  For  some  aspects  of  ACT, 
differences  from  predicted  characteristics  are  likely  to  occur 
in  the  later  stages  of  flight  testing  because  they  are  towards 
the  flight  envelope  limits.  At  this  point,  it  may  be  assumed 
that  the  characteristics  are  being  identified  with  more 
certainty.  It  should  be  possible  to  accommodate  differences 
up  to  some  magnitude  (within  the  range  of  sensitivity?)  by 
gain  changes.  For  larger  differences,  the  really  good  design 
team  would  have  it  covered  through  the  "what  if'  exercises 
discussed  above  ! ! 
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Modelling  and  analysis  of  the  unaugmented  vehicle 

Before  beginning  any  control  law  design,  it  is  important  to 
study  and  fully  understand  the  dynamics  and  the  non- 
linearities  of  the  unaugmented  vehicle,  including  those  of 
the  FCS  hardware.  This  analysis  will  include  the  traditional 
aspects,  such  as  actuators,  the  air  data  system,  etc.,  but 
should  include  everything  affecting  the  control  system,  such 
as  the  powerplant.  It  is  also  important  to  understand  how 
these  are  likely  to  affect  the  aircraft’s  control  characteristics 
as  its  operating  condition  varies.  If  this  is  not  done  then 
there  are  likely  to  be  some  surprises  later  in  the  design 
process,  which  will  require  re-work,  i.e.  overruns  in  time 
and  money. 

This  is  where  considerations  that  were  used  in  the 
aerodynamic  design  can  be  integrated  into  the  modelling 
and  analysis.  An  estimate  of  probable  nonlinear  aspects 
should  be  included.  It  is  also  wise  to  consider  the  probable 
accuracy  of  the  predicted  characteristics  in  order  to  define 
appropriate  ranges  for  sensitivity  analyses  and  "what  if' 
exercises.  Obviously,  the  decision  on  how  ACT  will  be 
integrated  into  the  FCS  will  have  a large  influence  on  the 
results. 

Design  criteria  and  flying  qualities  specifications 

The  two  areas  above  are  essential  preparation  for  the  FCS 
design,  but  the  real  critical  point  of  the  whole  design  process 
starts  with  definition  of  the  design  requirements.  The 
biggest  influence  of  ACT,  and  also  the  most  critical,  is  in 
this  definition  of  design  criteria.  The  design  team  (which  is 
discussed  further  as  a management  practice)  needs  to  agree 
on  the  criteria.  Many  aspects  of  ACT  are  not  covered 
explicitly  in  military  specifications,  therefore,  a clear 
agreement  on  the  intent  and  the  extent  needs  to  be 
documented  at  this  point.  The  requirements  will  also  vary 
significantly  depending  on  the  class  of  aircraft  being 
considered  and  its  mission. 

The  military  flying  qualities  specifications  may  have  been 
misused  as  often  as  they  have  been  used  correctly.  A very 
common  statement  is  that  they  apply  only  to  the  linear 
small-amplitude  responses.  The  US  military  specifications 
have  never  stated  this,  they  actually  defined  flight  envelopes 
over  which  the  required  criteria  were  to  apply.  Because  of 
the  practical  problem  of  the  unavailability  of  non-linear 
theories,  the  non-linear  effects  have  frequently  been 
neglected,  or  even  ignored,  in  the  past. 

The  introduction  of  Equivalent  Systems  into  MIL-F-8785C 
(Reference  5)  provided  a means  to  characterize  the  actual 
aircraft  response,  whether  it  was  linear  or  non-linear.  There 
was  an  explicit  requirement  stated  in  the  specification  that 
ALL  non-linearities  were  to  be  included  in  the  equivalent 
system.  The  characterization  was  in  terms  of  a conventional 


linear  response  model,  and  was  therefore,  mathematically 
not  exact.  Such  an  approach  would  be  a better  start  than 
nothing.  Since  the  introduction  of  MIL-F-8785C,  other 
methodologies  have  been  developed  which  apply  equally  to 
non-linear  responses  as  well  as  the  linear,  e.g.  Reference  6. 
The  problem  will  be  how  to  produce  credible  models, 
especially  the  nonlinearities 

Many  aspects  of  ACT,  especially  protection  against 
violating  limits  of  the  flight  envelope,  should  be  expected  to 
require  consideration  of  non-linearities.  One  example  is  the 
protection  against  departure  as  angle  of  attack  increases  into 
a range  that  may  trigger  uncontrollable  yaw  if  the  pilot 
commands  too  high  a roll  rate.  The  solution  is  typically  a 
non-linear  command  gain  as  the  aerodynamic  characteristics 
are  becoming  more  and  more  non-linear.  This  non-linearity 
is  straightforward  and  relatively  benign.  At  the  other 
extreme  may  be  the  requirement  to  consider  actuation 
deflection,  rate  and  acceleration  limits  as  part  of  the 
recovery  control  laws.  The  recommended  approach  is  to 
include  a spectrum  of  nonlinearities,  even  based  on 
judgement  until  more  refined  models  can  be  developed. 

The  recommended  Best  Practice  to  define  the  system  flying 
qualities  requirements  would  be  to  extend  the  military 
specification  criteria  rather  than  just  discard  them.  The  first 
question  would  be  whether  the  mission  required  the  system 
to  limit  responses  to  stay  within  a conventional  envelope  or 
provide  satisfactory  flying  qualities  in  an  extended 
envelope.  As  an  example,  the  Permissible  Flight  Envelope 
can  be  defined  to  extend  to  any  angle  of  attack.  A first 
estimate  of  required  characteristics  throughout  this 
envelope,  including  recovery  into  the  conventional 
envelope,  should  be  the  starting  point.  They  can  then  be 
augmented  with  automatic  functions  and  a definition  of  the 
extent  of  intervention  into  the  pilot  control. 

Control  law  design  and  development 

In  a classical  design  sense,  having  established  the  capability 
to  produce  linearized  models  of  the  aircraft,  its  powerplant 
and  FCS  hardware,  a grid  of  design  points  are  selected  to 
cover  the  required  flight  envelope.  A series  of  localized 
controllers  are  then  designed  and  implemented  using  gain 
schedules  to  cover  the  flight  envelope.  At  this  stage, 
additional  non-linear  functionality  is  added,  for  example 
rate  limiting  functions  and  authority  limits.  There  then 
follows  a comprehensive  assessment  of  the  design,  leading 
through  to  flight  clearance. 

Reference  1 then  continues  with  twenty  Best  Practices,  the 
last  of  which  concerns  the  design  methodology.  In  the 
report  it  is  stated  that  no  correlation  was  found  between  FCS 
problems  of  the  past  and  the  methods  used.  There  is  also 
the  promise  that  future  developments  of  modem  control, 
such  as  robust  control  theory,  will  change  the  emphasis  of 
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the  given  list  of  best  practices.  There  should  always, 
however,  be  the  judgment  and  insight  that  comes  from  some 
application  of  a disciplined  approach  of  designing  to  the 
agreed  criteria.  The  physics  of  flight  remain  the  same, 
irrespective  of  the  design  methodology. 

When  designing  the  control  laws  with  ACT,  at  the  lower 
levels,  the  pilot  command  inputs  are  reduced  to  avoid 
violation  of  all  given  stability  and  controllability  margins 
and  additional  limitations  (e.g.  load  factor).  At  the  higher 
levels,  the  automatic  system  provides  inputs  that  can  change 
the  pilot  inputs  dramatically.  There  is  then  always 
discussion  as  to  whether  the  system  is  improving  what  the 
pilots  think  they  can  do.  For  the  future,  therefore,  the 
"fuzzy  logic"  requirement  for  ACT  is  "to  prevent  all  bad 
things  from  happening  but  the  agility  of  the  aircraft  must  not 
be  reduced  too  much".  This  is  a subjective  evaluation  when 
the  pilots  think  that  the  control  laws  are  preventing  them 
from  achieving  some  realizable  performance  objective.  Part 
of  the  solution  to  this  problem  of  acceptance  is  to  design  for 
minimum  intervention,  as  discussed  above  in  all  three  areas. 
Finally,  it  is  mandatory  that  pilot  selectable  features  should 
not  be  "dormant",  i.e.  it  must  be  clear  to  every  pilot  exactly 
what  the  selected  configuration  is. 

Control  laws  functional  specification,  implementation  and 
verification 

Whether  the  flight  control  laws  are  to  be  implemented  in  an 
analogue  or,  more  usually  these  days,  a digital  flight  control 
computer,  some  means  of  functional  specification  is  needed 
to  enable  the  laws  to  be  implemented.  For  digital  flight 
control,  the  functional  specification  will  enable  coding  into 
the  target  machine’s  language  and  allow  the  implementation 
to  be  verified  against  the  intentions  of  the  designer.  This, 
however,  relates  back  to  the  previous  Best  Practice  of 
thoroughly  documenting  “the  intent  of  the  designer”.  This 
does  not  change  if  the  ACT  aspects  are  an  integral  feature  of 
the  FCS,  but  'add-on  features'  must  follow  the  same  rules. 

Piloted  simulation  and  handling  qualities 

It  is  common  practice  for  the  control  laws  to  be  thoroughly 
evaluated  by  piloted  simulation.  The  initial  task  is  to  set  up 
the  control  laws  within  the  simulator’s  real-time 
environment  and  to  establish  the  interface  between  the 
control  laws  and  the  pilot’s  controls  and  displays.  The 
implementation  must  then  be  verified,  prior  to  exposing  the 
simulation  to  pilots.  A series  of  piloted  evaluations  then 
takes  place,  during  which  the  handling  qualities  and  mission 
effectiveness  of  the  augmented  aircraft  are  assessed.  This 
usually  results  in  further  developments  of  the  control  laws, 
as  handling  deficiencies  are  identified.  It  is  critical, 
however,  that  this  further  development  is  done  analytically. 


A best  practice  is  to  plan  for  an  integrated  simulation 
program  and  ensure  that  all  IPT  members  (especially  pilots 
and  managers)  are  clear  that  the  various  simulators  are  for 
evaluation  purposes,  to  feed  data  back  into  the  analytical 
design  process.  Also,  deliberately  search  for  handling 
problems,  including  the  effects  of  design  tolerances 
(parameter  uncertainties)  and  failures.  Identify  the  worst 
cases  and  any  hidden  weaknesses  in  the  design,  and  fully 
explain  any  unexpected  simulation  results.  A significant 
aspect  of  this  recommendation  is  to  use  tasks  which 
deliberately  drive  high  pilot  gain.  This  can  be  done  through 
very  stringent  task  performance  requirements,  or  discrete 
gusts  (not  continuous  turbulence  that  a pilot  can  ignore).  It 
is  critical  that  this  part  of  the  simulation  should  not  be  a 
check  list  of  maneuvers  that  the  pilot  flies  in  a "relaxed" 
environment. 

Relative  to  ACT2,  evaluate  the  ability  of  the  pilot  to  enter  or 
re-enter  the  control  loop,  and  obviously  evaluate  the  pilot 
interface  with  the  automatic  functions.  Show  that  there  is 
no  tendency  for  divergence  between  the  automatic  and 
manual  control  functions.  Much  of  the  preceding  discussion 
has  emphasized  non-linearities.  The  simulation  is  where 
something  like  a non-linear  stability  problem  may  be  found. 
In  such  a case,  restricting  the  pilot's  commands  may  help 
but  is  unlikely  to  provide  a full  solution.  There  still  may  be 
a stability  problem  provoked  by  an  external  disturbance,  the 
effects  of  gusts  should  be  examined. 

Aeroservoelasticity  and  structural  mode  filter  design 

The  primary  function  of  the  flight  control  laws  is  to  provide 
the  aircraft  with  good  handling  qualities  by  using  feedback 
to  the  flying  control  surfaces.  The  airframe  is  not  rigid  and 
has  many  structural  modes  of  vibration  that  may  be  excited 
by  the  control  surface  movements.  The  response  of  these 
lightly  damped  modes  can  be  detected  by  the  motion  sensors 
and  fed  back  to  the  control  surfaces,  with  the  potential  for 
closed-loop  instability  at  the  structural  mode  frequencies. 
The  application  of  modem  high  bandwidth  flight  control 
systems  and  advanced  aerodynamic  configurations  has  led 
to  an  increase  in  the  levels  of  interaction  between  the 
airframe  and  its  FCS.  The  aeroservoelasticity  specialist  has 
the  task  of  defining  a set  of  structural  mode  filters  that 
provide  sufficient  attenuation  of  the  structural  mode  content 
of  motion  feedback  signals.  The  inclusion  of  ACT  changes 
neither  the  requirement  for  these  analyses  nor  the  Best 
Practices  hi  reference  1 . 

Design  robustness  and  flight  clearance 

The  certification  or  flight  clearance  process  is  essentially 
aimed  at  providing  the  evidence  in  order  to  certify  that  the 
aircraft  is  safe  to  fly.  The  qualification  (validation)  process 
is  aimed  at  demonstrating  that  the  design  qualifies  in 
meeting  its  design  specification.  If  a satisfactory  design  has 
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been  achieved  in  accordance  with  the  design  requirements 
and  guidelines,  and  the  functionality  is  clearly  defined,  then 
these  tasks  should  be  relatively  straightforward.  However, 
the  task  is  usually  large  and  detailed,  since  there  are  very 
many  cases  which  need  to  be  assessed,  covering  a wide 
range  of  aircraft  configurations  and  states,  including 
parameter  uncertainties,  which  have  to  be  evaluated  against 
a range  of  criteria  to  assess  different  aspects  associated  with 
safety  and  performance. 

For  ACT  aspects,  the  piloted  simulator  should  be  used  to 
complement  the  off-line  analyses  and  in  particular,  to  cany' 
out  more  detailed  investigations  for  regions  of  low  stability 
or  unusual  handling.  A critical  area  to  investigate  is  the 
sensitivity  to  variations  in  certain  basic  model  parameters. 
Some  FCS  design  methods  provide  an  estimate  of 
‘robustness’.  This  should  also  be  augmented  with  a more 
deterministic  approach  based  on  an  assessment  of  model 
accuracy.  Transients  due  to  gusts,  failures  and  mode 
changes  should  also  be  considered.  Assessment  of  carefree 
handling  functions  needs  to  be  very  thorough,  in  order  to 
demonstrate  that  the  system  is  fully  effective.  This  effort, 
however,  will  clear  the  system  to  enter  a flight  test  program 
where  the  system  will  be  finally  validated 

Developments  during  flight  testing 

A safe  and  well-planned  program  for  the  flight  testing  of  the 
aircraft  and  its  flight  control  system  is  essential.  Flight 
testing  of  a flight  control  system  usually  involves  some  risk 
due  to  the  uncertainties  in  the  models  used  to  establish  the 
design,  although  this  can  be  minimized  by  some  of  the  best 
practices  already  covered.  Once  the  flight  test  program  has 
commenced,  parameter  identification  is  usually  carried  out, 
in  order  to  validate  the  aircraft  model.  This  leads  to  further 
flight  clearances  and  increased  confidence,  enabling  flight 
envelope  expansion  to  continue  in  a safe  and  progressive 
manner. 

For  the  higher  levels  of  ACT  implementation,  special  flight 
test  procedures  may  be  used  and  an  example  is  discussed  in 
Reference  1.  Before  giving  a clearance  for  “carefree” 
handling  flight  tests,  there  were  numerical  simulations  to 
show  that  the  violations  of  defined  boundaries  stayed  inside 
the  allowed  safety  margin  even  for  the  worst  case 
configurations.  One  of  the  main  problems  is  that  it  is  a 
multi-dimensional  problem,  where  some  parameters  can 
augment  each  other.  Moreover  we  have  to  look  at  a wide 
range  of  center  of  gravity,  and  during  the  prototype  tests 
there  are  big  tolerances  on  the  aerodynamic  modelling  and 
the  sensor  system.  Additional  emergency  precautions  were 
done  for  one  prototype.  There  were  spin  tests  in  the  wind 
tunnel,  a spin  chute  was  fitted  to  that  prototype,  automatic 
start  of  the  APU  if  the  main  engines  stop  due  to  spin,  an 
extended  emergency  limit  for  the  actuator  rate,  an 
emergency  recovery  mode  of  the  flight  controller  with 


increased  pilot  authority,  etc.  Only  this  one  prototype  was 
allowed  to  fly  in  certain  flight  regions  that  were  restricted 
for  all  other  vehicles  in  the  flight  program. 

At  some  point,  the  aircraft  behavior  may  become 
significantly  different  from  that  predicted.  The  difference 
must  be  analyzed  carefully,  especially  any  trend  with  flight 
condition.  There  are  many  cases  where  differences  were 
observed  but  thought  to  be  small  enough  to  allow  flight 
testing  to  continue  - until  an  incident  occurred.  At  some 
point  the  behavior  is  deemed  to  be  unacceptable,  then 
control  law  changes  will  need  to  be  introduced  during  the 
flight  test  program.  Clearly,  this  needs  to  be  done  efficiently 
and  safely  in  order  to  meet  overall  program  timescales.  Any 
differences  in  predicted  behavior  should  always  be 
investigated  and  fully  explained. 

Design  considerations  for  PIO  prevention 

Although  the  application  of  the  best  practices  in  reference  1 
will  help  to  avoid  pilot  involved  oscillations,  it  is  considered 
that  this  topic  warrants  further  comment,  due  to  the 
problems  it  has  caused  the  flight  controls  community  in 
general.  Much  research  has  been  carried  out  on  this  subject 
in  recent  years  and  the  many  results  available  can  be  quite 
daunting  for  a budding  flight  control  engineer.  To  continue 
the  earlier  theme,  the  overall  fuzzy  logic  is  for  the  aircraft 
‘a)  to  do  what  the  pilot  wants  to  do  when  he  wants  it,  b)  to 
prevent  any  unintended  responses,  and  c)  only  take 
command  if  the  pilot  tries  to  do  something  really  stupid’.  In 
terms  of  PIO,  however,  the  overriding  two  principles  are 
extremely  simple.  First,  minimize  time  delays  and  phase 
lag,  and  second  ensure  that  the  pilot's  command  gain  is 
neither  too  high  nor  too  low. 

The  first  of  these  is  actually  very,  very  straightforward.  The 
mil  spec  approach,  through  the  use  of  equivalent  systems, 
requires  that  the  equivalent  system  time  delay  be  less  than 
100msec  for  Level  1 flying  qualities.  The  required 
definition  is  in  the  frequency  range  of  pilot  control  and,  with 
the  previously  discussed  requirement  to  include  all  non- 
linearities,  will  satisfy  the  requirements.  Couple  that  with 
the  criteria  by  John  Gibson  in  reference  6,  which  extends 
design  guidance  through  the  complete  frequency  range,  and 
time  delay  and  phase  lag  will  not  contribute  to  flying  quality 
deficiencies.  There  is  one  overriding  caveat  on  that 

assertion,  the  models  used  in  the  design  process  must  be 
accurate  to  within  a threshold  defined  and  considered  in  the 
design  process. 

The  second  aspect  has  caused  problems  in  the  past  through 
the  design  being  driven  by  simulation  rather  than  analytical 
criteria.  In  a simulator,  it  can  be  taken  as  a given  that  a pilot 
will  ask  for  more  command  gain,  more  response,  more, 
more,  more.  As  stated  above,  it  is  critical  to  search  for 
problem  areas.  The  test  plan  must  include  tasks  that  are 
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more  extreme  than  will  be  encountered  in  the  expected 
mission  use.  It  will  not  be  sufficient  to  fly  flight  mission 
profiles  or  demonstration  maneuvers  in  a straightforward, 
relaxed  manner.  A skilled  pilot  can  often  fly  a deficient 
configuration  until  some  event  drives  up  his  gain. 

Management  aspects 

All  good  management  practices  are  applicable  to  the 
development  of  the  flight  control  system,  and  it  is  not 
intended  here  to  write  about  what  constitutes  good 
management.  However,  there  are  some  practices  that  are 
worth  highlighting  in  order  to  emphasize  their  importance. 
The  best  overall  management  practice  is  to  ensure  that  the 
detailed  recommendations  in  Reference  1 are  applied  in  any 
flight  control  system  development. 

First,  a team  must  be  formed  to  include  representatives  from 
each  technical  discipline  and  organization  that  have  any 
contribution  to  the  system. 

A best  practice  is  to  plan  carefully  and  don’t  underestimate 
the  size  of  the  job  or  the  resources  required.  From  collective 
experience  of  earlier  projects,  it  must  be  assumed  that  there 
will  be  some  surprises  at  some  stage  during  the  flight 
control  system  development,  and  some  contingency 
planning  might  be  necessary,  including  provision  for 
software  updates. 

Lastly,  the  recommended  management  best  practice  relative 
to  ACT  is  to  ensure  that  it  is  integrated  into  the  FCS  design 
requirements  as  early  as  possible  and  follows  the  same 
disciplined  design  process. 

Conclusions 

Active  Control  Technology  (ACT)  can  now  be  considered 
as  part  of  the  basic  flight  control  requirements  of  a modem 
airplane.  There  is,  however,  a spectrum  of  detailed 
implementations  from  tailored  flying  qualities  to  automatic 
recovery  functions.  It  is  this  author's  prejudice  that  there  are 
two  absolutely  critical  points  in  any  flight  control  design 
activity.  First,  define  a complete  set  of  design  requirements, 

i.e.  flying  qualities  criteria,  up  front.  These  should  be  based 
on  the  US  Military  Specifications  augmented  for  the 
specific  application  with  an  understanding  of  the  intent  and 
expectations  for  each  criterion.  The  design  process  is  then  to 
meet  those  criteria  under  all  conditions,  especially  including 
predicted  nonlinearities.  Second,  any  deficiencies  indicated 
by  analysis,  simulation  or  flight  test  must  be  supported 
analytically  before  any  changes  to  the  criteria  are  allowed. 
The  control  system  must  not  be  tuned  in  the  simulator.  If 
the  specific  requirements  are  defined  early  in  the  program, 
and  then  the  design  follows  a disciplined  process  as 
indicated  in  Figure  1 and  also  expanded  in  Reference  1,  then 


there  is  every  reason  to  expect  a successful  system 
development. 
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Paper  #25 

Q by  Bill  Gubbels:  Do  you  consider  any  other  PIO  criteria  to  be  useful  or  is  Gibson’s  criteria  the  only 
one  you  would  say  holds  merit? 

A.  (D.  Moorhouse):  First,  I would  like  to  say  that  the  best  practice  is  to  design  for  Level  1 flying 
qualities  and  not  PIO  avoidance.  Gibson's  is  one  criterion  is  a good  way  to  do  that.  However,  there  are 
other  valid  PIO  criteria.  I have  used  Ralph  Smith's  criterion,  although  I do  not  agree  that  the  feel  system 
should  be  included  in  the  formulation. 

Q by  Daniel  Walker:  What  would  it  take  to  convince  you  that  one  design  method  for  FCS  was  maybe 
better  than  another  in  a particular  design  problem?  (vis-a-vis  author’s  statement  to  the  effect  that  the  best 
design  method  is  the  one  with  which  the  designer  was  most  comfortable)  (sic.) 

A.  (D.  Moorhouse):  First,  with  the  correct  design  criteria  and  good  models,  any  method  should  arrive  at 
the  right  answer  but  some  more  easily  than  others.  I might  also  refer  to  a paper  presented  in  1994  that 
does  discuss  the  best  application  of  different  methods  for  particular  parts  of  the  design  problem. 
{Moorhouse  and  Citurs,  "The  Control  System  Design  Methodology  of  the  STOL  and  Maneuver 
Technology  Demonstrator",  AGARD  Conference  Proceedings,  AGARD-CP-560}. 


